Security at ROASaurus

Last updated 29 October 2026

ROASaurus processes order and visitor data for webshops. This page describes how we protect it. The policies behind it are written for an auditor and kept in our repository; ask us for a copy.

Compliance status

ROASaurus is built to SOC 2 and ISO 27001 controls; an audit has not been completed yet. We do not hold a SOC 2 report or an ISO 27001 certificate, and we will say so here until we do.

Infrastructure

• The application, database and backups run at DigitalOcean in Amsterdam, the Netherlands (EU).
• The database is not reachable from the internet; the firewall only allows HTTPS, HTTP (redirected to HTTPS) and SSH.
• Server access is by SSH key only, with password logins disabled and repeated failed logins blocked; security updates install automatically.
• Nightly database backups are kept for 14 days.

Encryption

• All traffic uses TLS, with HSTS on our own domains.
• Ad platform tokens, API credentials and two-factor secrets are encrypted in the application with AES-256-GCM. Keys are versioned, and stored secrets are re-encrypted when a new key is introduced.
• Passwords are stored as salted scrypt hashes; API keys and session tokens only as SHA-256 hashes.
• Emails, phone numbers, names and addresses are hashed with SHA-256 before they are sent to ad platforms.

Access to your workspace

• Roles: owner, admin and member. Billing, the team and API keys are limited to owners and admins.
• Two-factor authentication with an authenticator app (TOTP) and single-use recovery codes; owners can require it for everyone in the workspace.
• Single sign-on with SAML 2.0 or OpenID Connect, for email domains verified by DNS, optionally required for members.
• Every user can see and end their sessions; owners can set an idle timeout.
• Our team can only open your workspace when the owner grants time-limited support access, which the owner can revoke at any time. Everything done under it is logged.

Audit log

Logins and failed logins, two-factor changes, role and team changes, API keys, data exports, support access, setting changes and deletions are written to an append-only audit log. Entries cannot be changed or deleted, and each one carries a hash of the previous entry. Owners can view and export their workspace's log.

Your data

• Owners choose how long raw events and visitor data are kept; older data is deleted every day.
• Removing a store deletes its data; Shopify's customer and shop deletion requests are carried out automatically.
• Consent is respected by default: visitors who decline marketing cookies get no visitor id and their browser events are not sent to ad platforms.
• Our sub-processors: DigitalOcean, LLC, Resend, Inc., Stripe Payments Europe, Ltd., Anthropic, PBC, Zoho Corporation B.V.. Details are in the data processing agreement.

Development and changes

Every change is tracked in version control and comes with automated tests; releases are deployed from the repository. The application uses a small set of third-party packages.

Reporting a vulnerability

If you find a security issue, email hello@roasaurus.com with the steps to reproduce it. We confirm receipt within 3 business days and keep you updated until it is fixed.

• Please test only against your own account and data, do not access or change other customers' data, and do not run denial-of-service, spam or social engineering tests.
• Give us reasonable time to fix the issue before you share it publicly.
• We will not take legal action against research done in good faith within these rules.
• We do not run a paid bug bounty.

Our security.txt lists the same contact. Bullito, Ceintuurbaan 211, 3051 KC Rotterdam, the Netherlands.